Related to #275
Track the organization-wide rollout of zizmor scanning through the OpenTelemetry shared workflow , along with enforcement through the repository rulesets managed in open-telemetry/admin.
Status
44 of 82 enforced (54%) | inventory refreshed 2026-08-28
State
Count
Meaning
Blocked
19
Needs intervention before rollout can continue
Adoption in review
6
Caller PR is open and awaiting review or merge
Adoption merged, enforcement pending
7
Caller merged; post-merge verification or admin enforcement remains
Not started
6
Eligible inventory repository with no rollout PR yet
Enforced
44
Scanning and branch-rule enforcement are active
Rollout checklist
Rows are grouped by next action and sorted by repository. A row is checked only after scanning and enforcement are active.
Blocked
open-telemetry/opamp-go : ci: add shared security scanning workflow opamp-go#613 open-telemetry/opentelemetry-android : ci: add shared security scanning workflow opentelemetry-android#1900 ci: document safe CodeQL cache usage opentelemetry-android#1967 open-telemetry/opentelemetry-collector-contrib : ci: add shared security scanning workflow opentelemetry-collector-contrib#50484 open-telemetry/opentelemetry-dotnet : [Infra] move security scanning to shared workflow opentelemetry-dotnet#7574 open-telemetry/opentelemetry-dotnet-contrib : [Infra] Move security scanning to shared workflow opentelemetry-dotnet-contrib#4923 open-telemetry/opentelemetry-ebpf-instrumentation : ci: move security scanning to shared workflow opentelemetry-ebpf-instrumentation#3202 open-telemetry/opentelemetry-ebpf-profiler : ci: add shared security scanning workflow opentelemetry-ebpf-profiler#1796 open-telemetry/opentelemetry-java : ci: remediate zizmor findings opentelemetry-java#8592 open-telemetry/opentelemetry-java-contrib : ci: remediate zizmor findings opentelemetry-java-contrib#3009 open-telemetry/opentelemetry-java-examples : ci: remediate zizmor findings opentelemetry-java-examples#1218 open-telemetry/opentelemetry-java-instrumentation : ci: remediate zizmor findings opentelemetry-java-instrumentation#19283 ci: clear remaining zizmor findings opentelemetry-java-instrumentation#19339 open-telemetry/opentelemetry-operator : ci: add shared security scanning workflow opentelemetry-operator#5483 open-telemetry/opentelemetry-php-contrib : ci: add shared security scanning workflow opentelemetry-php-contrib#677 Fix workflows after Zizmor. opentelemetry-php-contrib#679 ci: resolve residual zizmor findings opentelemetry-php-contrib#681 open-telemetry/opentelemetry-python-genai : ci: add shared security scanning workflow opentelemetry-python-genai#473 open-telemetry/opentelemetry-ruby : ci: add shared security scanning workflow opentelemetry-ruby#2251 open-telemetry/opentelemetry-ruby-contrib : ci: add shared security scanning workflow opentelemetry-ruby-contrib#2462 open-telemetry/opentelemetry-ruby-instrumentation : ci: disable caching in release workflow opentelemetry-ruby-instrumentation#99 ci: move security scanning to shared workflow opentelemetry-ruby-instrumentation#48 open-telemetry/semantic-conventions-genai : ci: add shared security scanning workflow semantic-conventions-genai#382 open-telemetry/semantic-conventions-java : ci: remediate zizmor findings semantic-conventions-java#538
Adoption in review
Adoption merged, enforcement pending
Not started
Enforced
open-telemetry/.github : ci: add shared security scanning workflow .github#89 open-telemetry/build-tools : ci: add shared security scanning workflow build-tools#502 open-telemetry/community : ci: add shared security scanning workflow community#3648 open-telemetry/cpp-build-tools : ci: add shared security scanning workflow cpp-build-tools#21 open-telemetry/opentelemetry-benchmarks : ci: move security scanning to shared workflow opentelemetry-benchmarks#17 open-telemetry/opentelemetry-browser : ci: move security scanning to shared workflow opentelemetry-browser#379 open-telemetry/opentelemetry-collector : open-telemetry/admin#874, (repository scanning already active) open-telemetry/opentelemetry-configuration : chore: add zizmor workflow opentelemetry-configuration#725 ci: add shared security scanning workflow opentelemetry-configuration#732 open-telemetry/opentelemetry-cpp : ci: add shared security scanning workflow opentelemetry-cpp#4465 open-telemetry/opentelemetry-cpp-contrib : ci: add shared security scanning workflow opentelemetry-cpp-contrib#664 open-telemetry/opentelemetry-demo : ci: move security scanning to shared workflow opentelemetry-demo#3900 open-telemetry/opentelemetry-dotnet-instrumentation : ci: move security scanning to shared workflow opentelemetry-dotnet-instrumentation#5317 open-telemetry/opentelemetry-ecosystem-explorer : ci: move security scanning to shared workflow opentelemetry-ecosystem-explorer#922 open-telemetry/opentelemetry-erlang-contrib : ci: add shared security scanning workflow opentelemetry-erlang-contrib#763 open-telemetry/opentelemetry-for-beginners : ci: add shared security scanning workflow opentelemetry-for-beginners#15 open-telemetry/opentelemetry-go : ci: add shared security scanning workflow opentelemetry-go#8684 open-telemetry/opentelemetry-go-build-tools : ci: add shared security scanning workflow opentelemetry-go-build-tools#2071 [chore] pin securego/gosec to v2.28.0 instead of master opentelemetry-go-build-tools#2086 open-telemetry/opentelemetry-go-contrib : ci: add shared security scanning workflow opentelemetry-go-contrib#9397 open-telemetry/opentelemetry-go-instrumentation : ci: add shared security scanning workflow opentelemetry-go-instrumentation#3726 open-telemetry/opentelemetry-go-vanityurls : ci: add shared security scanning workflow opentelemetry-go-vanityurls#177 open-telemetry/opentelemetry-injector : ci: add shared security scanning workflow opentelemetry-injector#422 open-telemetry/opentelemetry-js : ci: move security scanning to shared workflow opentelemetry-js#6976 open-telemetry/opentelemetry-js-contrib : ci: move security scanning to shared workflow opentelemetry-js-contrib#3656 open-telemetry/opentelemetry-kotlin : ci: add shared security scanning workflow opentelemetry-kotlin#681 open-telemetry/opentelemetry-packaging : ci: add shared security scanning workflow opentelemetry-packaging#24 Fix zizmor findings in packaging workflows opentelemetry-packaging#53 open-telemetry/opentelemetry-php : ci: add shared security scanning workflow opentelemetry-php#2024 open-telemetry/opentelemetry-php-distro : ci: add shared security scanning workflow opentelemetry-php-distro#145 open-telemetry/opentelemetry-proto : ci: add shared security scanning workflow opentelemetry-proto#847 open-telemetry/opentelemetry-proto-go : ci: add shared security scanning workflow opentelemetry-proto-go#675 open-telemetry/opentelemetry-proto-java : ci: colocate zizmor suppression rationales opentelemetry-proto-java#263 open-telemetry/opentelemetry-specification : ci: add shared security scanning workflow opentelemetry-specification#5277 open-telemetry/opentelemetry-weaver-examples : ci: add shared security scanning workflow opentelemetry-weaver-examples#94 open-telemetry/opentelemetry-weaver-packages : ci: add shared security scanning workflow opentelemetry-weaver-packages#56 open-telemetry/opentelemetry-website-infra : ci: move security scanning to shared workflow opentelemetry-website-infra#4 open-telemetry/opentelemetry-zig : ci: add shared security scanning workflow opentelemetry-zig#70 open-telemetry/opentelemetry.io : ci: move security scanning to shared workflow opentelemetry.io#11427 open-telemetry/semantic-conventions : Add shared zizmor workflow semantic-conventions#3895 ci: use checkout credentials for git pushes semantic-conventions#3918 open-telemetry/semantic-conventions-conformance : ci: move security scanning to shared workflow semantic-conventions-conformance#60 open-telemetry/semantic-conventions-mainframe : ci: move security scanning to shared workflow semantic-conventions-mainframe#25 open-telemetry/sig-contributor-experience : ci: add shared security scanning workflow sig-contributor-experience#120 open-telemetry/sig-developer-experience : ci: add shared security scanning workflow sig-developer-experience#105 open-telemetry/sig-end-user : ci: add shared security scanning workflow sig-end-user#383 open-telemetry/sig-profiling : ci: add shared security scanning workflow sig-profiling#176 open-telemetry/sig-security : ci: add shared security scanning workflow #312
Exclusions
open-telemetry/shared-workflows : shared workflow repository self-scans and must not call itself
Add future rollout and enforcement PRs to this checklist, and link their descriptions back to this issue.
Related to #275
Track the organization-wide rollout of zizmor scanning through the OpenTelemetry shared workflow, along with enforcement through the repository rulesets managed in
open-telemetry/admin.Status
44 of 82 enforced (54%) | inventory refreshed 2026-08-28
Rollout checklist
Rows are grouped by next action and sorted by repository. A row is checked only after scanning and enforcement are active.
Blocked
Adoption in review
Adoption merged, enforcement pending
Not started
Enforced
Exclusions
Add future rollout and enforcement PRs to this checklist, and link their descriptions back to this issue.